CenterPoint Energy confirms data breach following claims on hacking forum
CenterPoint Energy confirmed a breach after a hacker claimed stealing 7.49 million customer records via an unauthenticated API lacking WAF, rate limiting, and token checks.
CenterPoint Energy, a Houston-based utility serving about 7 million customers, confirmed in a September 14 SEC Form 8-K that an unauthorized third party accessed customer data through an external system after a hacker posted a 7.49 million-line dataset online. The exposed fields include names, phone numbers, addresses, account numbers, emails, driver's license numbers, and the last four digits of Social Security numbers. The hacker said the API had no web application firewall, rate limiting, certificate checks, or authentication token, and that a CAPTCHA stopped exfiltration at 7.49 million of a claimed 17.44 million lines. The company faces multiple class action lawsuits and is working with outside experts to determine scope.
- Hacker alias '4d722e4d656f77' claims 7.49M lines pulled in JSONL then CSV
- Unauthenticated API lacked WAF, rate limiting, certificate checks, and tokens
- Exposed data includes driver's license numbers and last four SSN digits
- CenterPoint filed SEC 8-K on September 14; utility services unaffected
- Multiple class action lawsuits filed by customers across several states
Full article341 words · extracted from helpnetsecurity.com · click to collapse
CenterPoint Energy disclosed that an unauthorized third party got into customer data through one of its external systems, after online claims by a hacker that millions of records had been stolen from the company.
CenterPoint Energy is a Houston-based public utility company that provides electricity and natural gas services. It serves about 7 million customers across Indiana, Minnesota, Ohio, and Texas.
A hacker, posting under the alias ‘4d722e4d656f77,’ claims to have pulled 7.49 million lines of CenterPoint customer data through an API that had no web application firewall, no rate limiting, no certification checks, and no authentication token.
The threat actor wrote that the data was pulled in JSONL format, then filtered into CSV files that keep the personal information intact. The post calls it “funny” that a company CenterPoint’s size had such weak protection, and notes that a CAPTCHA cut the download short at 7.49 million lines. Without it, the threat actor wrote, “we would have pulled 17.44 million data.”
The listed fields include customer names, phone numbers, service and billing addresses, account numbers, premise IDs, billing amounts, due dates, autopay and paperless billing status, rate class, email addresses, driver’s license numbers, and the last four digits of Social Security numbers.
In an SEC Form 8-K filed on September 14, CenterPoint confirmed it became aware of an online post by a third party claiming to hold a data set containing customer information.
The company added it’s continuing to work with outside experts to determine the scope of the breach, and that it “intends to notify affected customers and regulatory authorities as required by applicable law.”
“The Company’s delivery of electric and gas services has not been impacted and remains operational and undisrupted. As of the date of this filing, the Company does not believe it is reasonably likely that there will be a material impact on the Company’s financial condition or results of operations,“ reads the SEC filing.
Local media write that CenterPoint Energy is facing several class action lawsuits from customers in multiple states over an alleged data breach.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/09/16/centerpoint-energy-data-breach-hacker-claims/